Phase encoding schemes for measurement device independent quantum key 

distribution with basis-dependent flaw 
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In this paper, we study the unconditional security of the so-called measurement device independent 
quantum key distribution (MDIQKD) with the basis-dependent flaw in the context of phase encoding 
schemes. We propose two schemes for the phase encoding, the first one employs a phase locking 
technique with the use of non-phase-randomized coherent pulses, and the second one uses conversion 
of standard BB84 phase encoding pulses into polarization modes. We prove the unconditional 
security of these schemes and we also simulate the key generation rate based on simple device 
models that accommodate imperfections. Our simulation results show the feasibility of these schemes 
with current technologies and highlight the importance of the state preparation with good fidelity 
between the density matrices in the two bases. Since the basis-dependent flaw is a problem not only 
for MDIQKD but also for standard QKD, our work highlights the importance of an accurate signal 
source in practical QKD systems. 

Note: We include the erratum of this paper in Appendix C. The correction does 
not affect the validity of the main conclusions reported in the paper, which is the 
importance of the state preparation in MDIQKD and the fact that our schemes can 
generate the key with the practical channel mode that we have assumed. 

PACS numbers: 



I. INTRODUCTION 

Quantum key distribution (QKD) is often said to be 
unconditionally secure [IH3]- More precisely, QKD can 
be proven to be secure against any eavesdropping given 
that the users' (Alice and Bob) devices satisfy some re- 
quirements, which often include mathematical character- 
ization of users' devices as well as the assumption that 
there is no side-channel. This means that no one can 
break mathematical model of QKD, however in practice, 
it is very difficult for practical devices to meet the require- 
ments, leading to the breakage of the security of practical 
QKD systems. Actually, some attacks on QKD have been 
proposed and demonstrated successfully against practical 
QKD systems 0,i]. 

To combat the practical attacks, some counter- 
measures @ , including device independent security proof 
idea Q , have been proposed. The device independent se- 
curity proof is very interesting from the theoretical view- 
point, however it cannot apply to practical QKD systems 
where loopholes in testing Bell's inequality [8[ cannot be 
closed. As for the experimental counter-measures, battle- 
testing of the practical detection unit has attracted many 
researchers' attention Q since the most successful prac- 



tical attack so far is to exploit the imperfections of the 
detectors. 

Recently, a very simple and very promising idea, 
which is called a measurement device independent QKD 
(MDIQKD) has been proposed by Lo, Curty, and Qi [9]. 
In this scheme, neither Alice nor Bob performs any mea- 
surement, but they only send out quantum signals to a 
measurement unit (MU). MU is a willing participant of 
the protocol, and MU can be a network administrator or 
a relay. However, MU can be untrusted and completely 
under the control of the eavesdropper (Eve). After Al- 
ice and Bob send out signals, they wait for MU's an- 
nouncement of whether she has obtained the successful 
detection, and proceed to the standard post-processing 
of their sifted data, such as error rate estimation, er- 
ror correction, and privacy amplification. The basic idea 
of MDIQKD is based on a reversed EPR-based QKD 
protocol [loj . which is equivalent to EPR-based QKD 
111 in the sense of the security, and MDIQKD is re- 
markable because it removes all the potential loopholes 
of the detectors without sacrificing the performance of 
standard QKD since Alice and Bob do not detect any 
quantum signals from Eve. Moreover, it is shown in [9j 
that MDIQKD with infinite number of decoy states and 
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polarization encoding can cover about twice the distance 
of standard decoyed QKD, which is comparable to EPR- 
based QKD. The only assumption needed in MDIQKD 
is that the preparation of the quantum signal sources by 
Alice and Bob is (almost) perfect and carefully character- 
ized. We remark that the characterization of the signal 
source should be easier than that of the detection unit 
since the characterization of the detection unit involves 
the estimation of the response of the devices to unknown 
input signals sent from Eve. 

With MDIQKD in our hand, we do not need to worry 
about imperfections of MU any more, and we should 
focus our attention more to the imperfections of sig- 
nal sources. One of the important imperfections of the 
sources is the basis-dependent flaw that stems from the 
discrepancy of the density matrices corresponding to the 
two bases in BB84 states. The security of standard BB84 
with basis-dependent flaw has been analyzed in [l2T - fl4l ] 
which show that the basis-dependent flaw decreases the 
achievable distance. Thus, in order to investigate the 
practicality of MDIQKD, we need to generalize the above 
works to investigate the security of MDIQKD under the 
imperfection. Another problem in MDIQKD is that the 
first proposal is based on polarization encoding j|| , how- 
ever, in some situations where birefringence effect in op- 
tical fiber is highly time-dependent, we need to consider 
MDIQKD with phase encoding rather than polarization 
encoding. In this paper, we study the above issues simul- 
taneously. 

We first propose two schemes of the phase encoding 
MDIQKD, one employs phase locking of two separate 
laser sources and the other one uses the conversion of 
phase encoding into polarization encoding. Then, we 
prove the unconditional security of these schemes with 
basis -dep endent flaw by generalizing the quantum coin 
idea |I2h141 |. Based on the security proof, we simulate 
the key generation rate with realistic parameters, espe- 
cially we employ a simple model to evaluate the basis- 
dependent flaw due to the imperfection of the phase 
modulators. Our simulation results imply that the first 
scheme covers shorter distances and may require less ac- 
curacy of the state preparation, while the second scheme 
can cover much longer distances when we can prepare the 
state very precisely. We note that in this paper we con- 
sider the most general type of attacks allowed by quan- 
tum mechanics and establish unconditional security for 
our protocols. 

This paper is organized as follows. In Sec. [TTl we give a 
generic description of MDIQKD protocol, and we propose 
our schemes in Sec. IHII and Sec. IIVI Then, we prove the 
unconditional security of our schemes in Sec. [Vj and 
we present some simulation results of the key generation 
rate based on realistic parameters in Sec. IVI1 Finally, we 
summarize this paper in Sec. IVII1 



II. PROTOCOL 

In this section, we introduce MDIQKD protocol whose 
description is generic for all the schemes that we will in- 
troduce in the following sections. The MDIQKD protocol 
runs as follows. 

Step (1): Each of Alice and Bob prepares a signal pulse 
and a reference pulse, and each of Alice and Bob ap- 
plies phase modulation to the signal pulse, which is ran- 
domly chosen from 0, tt/2, it, and 3ir/2. Here, {0, ir} 
({7r/2, 37r/2}) defines X (Y")-basis. Alice and Bob send 
both pulses through quantum channels to Eve who pos- 
sesses MU. 

Step (2): MU performs some measurement, and an- 
nounces whether the measurement outcome is successful 
or not. It also broadcasts whether the successful event is 
the detection of type-0 or type-1 (The two types of the 
successful outcomes correspond to two specific Bell states 

M)- 

Step (3): If the measurement outcome is successful, 
then Alice and Bob keep their data. Otherwise, they dis- 
card the data. When the outcome is successful, Alice and 
Bob broadcast their bases and they keep the data only 
when the bases match, which we call sifted key. Depend- 
ing on the type of the successful event and the basis that 
they used, Bob may or may not perform bit-flip on his 
sifted key. 

Step (4): Alice and Bob repeat (l)-(3) many times 
until they have large enough number of the sifted key. 

Step (5): They sacrifice a portion of the data as the 
test bits to estimate the bit error rate and the phase error 
rate on the remaining data (code bits). 

Step (6): If the estimated bit error and phase error 
rates are too high, then they abort the protocol, other- 
wise they proceed. 

Step (7): Alice and Bob agree over a public channel 
on an error correcting code and on a hash function de- 
pending on the bit and phase error rate on the code bits. 
After performing error correction and privacy amplifica- 
tion, they share the key. 

The role of the MU in Eve is to establish a quantum 
correlation, i.e., a Bell state, between Alice and Bob to 
generate the key. If it can establish the strong correla- 
tion, then Alice and Bob can generate the key, and if it 
cannot, then it only results in a high bit error rate to 
be detected by Alice and Bob and they abort the proto- 
col. As we will see later, since Alice and Bob can judge 
whether they can generate a key or not by only check- 
ing the experimental data as well as information on the 
fidelity between the density matrices in X- basis and Y- 
basis, it does not matter who performs the measurement 
nor what kind of measurement is actually done as long as 
MU broadcasts whether the measurement outcome was 
successful together with the information of whether the 
successful outcome is type-0 or type- 1. 

In the security proof, we assume that MU is totally 
under the control of Eve. In practice, however, we should 
choose an appropriate measurement that establishes the 
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strong correlation under the normal operation, i.e., the 
situation without Eve who induces the channel losses and 
noises. In the following sections, we will propose two 
phase encoding MDIQKD schemes. 



III. PHASE ENCODING SCHEME I 

In this section, we propose an experimental setup for 
MDIQKD with phase encoding scheme, which is depicted 
in Fig. [TJ This scheme will be proven to be uncondition- 
ally secure, i.e., secure against the most general type of 
attacks allowed by quantum mechanics. In this setup, 
we assume that the intensity of Alice's signal (reference) 
pulse matches with that of Bob's signal (reference) pulse 
when they enter MU. In order to lock the relative phase, 
we use strong pulses as the reference pulses. In PL unit 
in the figure, the relative phase between the two strong 
pulses is measured in two polarization modes separately. 
The measurement result is denoted by k (here, the arrow 
represents two entries that correspond to the two relative 
phases). Depending on this information k, appropriate 
phase modulations for two polarization modes are ap- 
plied to incoming signal pulse from Alice. Then, Alice's 
and Bob's signal pulses are input into the 50/50 beam 
splitter which is followed by two single-photon threshold 
detectors. The successful event of type-0 (type-1) in step 
(2) is defined as the event where only DO (Dl) clicks. In 
the case of type-1 successful detection event, Bob applies 
bit flip to his sifted key (we define the phase relationship 
of BS in such a way that Dl never clicks when the phases 
of the two input signal coherent pulses are the same). 

Roughly speaking, our scheme performs double BB84 
[l6|, i.e., each of Alice and Bob is sending signals in the 



BB84 states, without phase randomization [14[. Differ- 
ences between our scheme and the polarization encod- 
ing MDIQKD scheme include that Alice and Bob do not 
need to share the reference frame for the polarization 
mode, since MU performs the feed-forward control of the 
polarization, and our scheme intrinsically possesses the 
basis-dependent flaw. 

To see how this particular setup establishes the quan- 
tum correlation under the normal operation, it is con- 
venient to consider an entanglement distribution scheme 
17], which is mathematically equivalent to the actual 
protocol. For the simplicity of the discussion, we assume 
the perfect phase locking for the moment and we only 
consider the case where both of Alice and Bob use X- 
basis. We skip the discussion for F-basis, however it 
holds in a similar manner [181 ] . In this case, the actual 
protocol is equivalently described as follows. First, Alice 
prepares two systems in the following state, which is a 
purification of the A-basis density matrix, 
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FIG. 1: Schematics of an experimental setup for the phase 
encoding scheme I. A-S (B-S) and A-R (B-R) respectively 
represents Alice's (Bob's) signal and reference pulses. The 
signal pulses are phase modulated according to Alice's and 
Bob's choice. OS represents an optical switch, which allows 
the reference pulse and the signal pulse to be transmitted and 
to be reflected, respectively. PL represents an unit measuring 
relative phase of two orthogonal polarization modes and it 
outputs the two relative phase information k. Then, the phase 
shift of k for each polarization mode is applied to one of the 
signal pulses, and they will be detected by DO and Dl after 
the interference at the 50:50 beam splitter BS. 



and sends the second system to MU through the quan- 
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turn channel. Here, 

coherent states that Alice prepares in the actual protocol 
{a a represents the mean photon number or inetensity), 
|0 X ) and \ l x ) are eigenstate of the computational basis (A 
basis), which is related with Y"-basis eigenstate through 
|0 V ) = (t 10,) + \1 X ))/V2 and |1„) = (10,) + i \l x ))/y/2. 
For the later convenience, we also define Z-basis states 
as |0 Z ) = (|0 X ) + |l a ))/V2 and |l z ) = (10,) - ID)A/2. 

Moreover, the subscript of 2 in 

that Alice is to measure her qubit along A-basis, the sub- 
script of A in ctA refers to the party who prepares the 
system, and the superscript (+) represents the relative 
phase of the superposition. Similarly, Bob also prepares 

sends the 



two systems in a similar state 

second system to MU, and performs A-basis measure- 
ment. Note that A-basis measurement by Alice and Bob 
can be delayed after Eve's announcement of the success- 
ful event without losing any generalities in the security 
analysis, and we assume this delay in what follows. 

In order to see the joint state of the qubit pair after the 
announcement, note that the beam splitter converts the 

into the follow- 
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ing state |C)ai,bi,do,di 



IV. PHASE ENCODING SCHEME II 
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Here, for the simplicity of the discussion, we assume that 
there is no channel losses, we define a a = olb = oi ', and 
|0) represents the vacuum state. Moreover, the subscripts 
DO and Dl represent the output ports of the beam split- 
ter. If detector DO (Dl) detects photons and the other 
detector Dl (DO) detects the vacuum state, i.e., type- 
(type-1) event, it is shown in the Appendix A that 
the joint probability of having type-0 (type-1) successful 
event and Alice and Bob share the maximally entangled 
state [*+) (I*-)) is (1 - e - 4a ')/4. We note that since 

Alice and Bob do not always share 

this state, and with a joint probability of (1 — e~ 2 " ) 2 /4, 
they have type-0 (type-1) successful event and share the 
maximally entangled state with the phase error, i.e., the 
bit error in F-basis, as |$ + ) (|$ - )). 

Note that the bit- flip operation in type-1 successful 
detection can be equivalently performed by n rotation 
around Z-basis before Bob performs X basis measure- 
ment. In other words, n rotation around Z-basis be- 
fore A-basis measurement does not change the statis- 
tics of the A-basis measurement followed by the bit-flip. 
Thanks to this property, we can conclude that Alice and 
Bob share |*+) with probability of (l-e~ w )/2 and |$+) 
with probability of (1 — e~ 2a ) 2 /2 after the rotation. This 
means that even if Alice and Bob are given the successful 
detection event, they cannot be sure whether they share 
|$ + ) or \*f? + ), however, if they choose a small enough a, 
then the phase error rate (the rate of the state |$ + ) in 
the qubit pairs remaining after the successful events or 
equivalently, the rate of K-basis bit error among all the 
shared qubit pairs) becomes small and they can gener- 
ate a pure state \^ + ) by phase error correction, which is 
equivalently done by privacy amplification in the actual 
protocol @. We note that the above discussion is valid 
only for the case without noises and losses, and we will 
prove the security against the most general attack in Sec. 
IVl without relying on the argument given in this section. 

We remark that in the phase encoding scheme I, it is 
important that Alice and Bob know quite well about the 
four states that they prepare. This may be accomplished 
by using state tomography with homodyne measurement 
involving the use of the strong reference pulse [l9j . 



In this section, we propose the second experimen- 
tal setup for MDIQKD with phase encoding scheme. 
Like scheme I, this scheme will also be proven to be 
unconditionally secure. In this scheme, the coherent 
pulses that Alice and Bob send out are exactly the 
same as those in the standard phase encoding BB84, i.e., 
|e 4 ^ +e ) y/a) \e l ^yfa) r where subscripts s and r respec- 
tively denote the signal pulse and the reference pulse, 
£ is a completely random phase, 9 is randomly chosen 
from {0, 7r/2, tt, 3tt/2} to encode the information. After 
entering the MU, each pulse pair is converted from a 
phase coding signal to a polarization coding signal by a 
phase-to-polarization converter (see details below). We 
note that thanks to the phase randomization by £, the 
joint state of the signal pulse and the reference pulse is 
a classical mixture of photon number states. 

In Fig. [21 we show the schematics of the converter. 
This converter performs the phase-to-polarization con- 
version: A \e i ^+^y/a) s \e K y/a) r to (|V) + e t0 \H))/V2, 

where Pi is a projector that projects the joint system 
of the signal and reference pulses to a two-dimensional 
single-photon subspace spanned by {|0) s |l) r , |l) s |0) r } 
where and 1 represent the photon number, and \H) 
(\V)) represents the horizontal (vertical) polarization 
state of a single-photon. To see how it works, let us 
follow the time evolution of the input state. At the po- 
larization beam splitter (PBS in Fig. [2]), the signal and 
reference pulses first split into two polarization modes, 
H and V, and we throw away the pulses being routed 
to V mode. Then, in H mode, the signal pulse and the 
reference pulse are routed to different paths by using an 
optical switch, and we apply 7r-rotation only to one of 
the paths to convert H to V. At this point, we essen- 
tially have (|V) + e 10 \H) lw )/\/2, where the subscripts 
of "up" and "lw" respectively denote the upper path and 
the lower path. Finally, these spatial modes up and lw 
are combined together by using a polarization beam split- 
ter so that we have (| V) + e 10 \H))/ V% in the output port 
depicted as "OUT". 

In practice, since the birefringence of the quantum 
channel can be highly time dependent and the polar- 
ization state of the input pulses to MU may randomly 
change with time, i.e., the input polarization state is a 
completely mixed state, we cannot deterministically dis- 
till a pure polarization state, and thus the conversion 
efficiency can never be perfect. In other words, one may 
consider the same conversion of the V mode just after 
the first polarization beam splitter, however it is impos- 
sible to combine the resulting polarization pulses from V 
mode and the one from H mode into a single mode. 

We assume that MU has two converters, one is for 
the conversion of Alice's pulse and the other one is for 
Bob's pulse, and the two output ports "OUT" are con- 
nected to exactly the same Bell measurement unit Q 
in the polarization encoding MDIQKD scheme in Fig. 
[3] @. This Bell measurement unit consists of a 50:50 
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FIG. 2: Schematics of an experimental setup of the converter from phase encoding to polarization encoding. PBS is a 
polarization beam splitter, OS represents an optical switch that routes the reference pulse and signal pulses to different paths. 
The 'V performs the conversion \H) — > \V). The circle represents time-delay. The italic characters along the lines represent 
the polarization state. 




FIG. 3: Schematics of an experimental setup of MU. A-S (B-S) and A-R (B-R) respectively represent Alice's (Bob's) signal 
and reference pulses, and MU consists of two converters for each pulse from Alice and Bob (depicted as "Conv"), and Bell 
measurement unit consists of a 50:50 beam splitter (BS) followed by two polarization beam splitters (PBSs). See the main text 
for the explanation. 



beam splitter, two polarization beam splitters, and four 
single-photon detectors, which only distinguishes per- 
fectly two out of the four Bell states of and 
The polarization beam splitters discriminate between 
|+) = (\H) + \V))/y/2 and |-) = (\H) - \V))/y/2 (note 
that we choose + and — modes rather than H and V 
modes since our computational basis is + and — ). Sup- 
pose that a single-photon enters both from Alice and 
Bob. In this case, the click of D0+ and DO- or D1+ 
and Dl- means the detection of and the click of 

D0+ and Dl- or DO- and D1+ means the detection of 
l^ - ) (see Fig. [3]). In this scheme, since the use of co- 
herent light induces non-zero bit error rate in F-basis 
({(\H)+i\V))/V2, QH) -i |I/))/v / 2}-basis), we consider 
to generate the key from {|+) , |— )}-basis and we use the 
data in F-basis only to estimate the bit error rate in this 
basis conditioned on that both of Alice and Bob emit a 
single-photon, which determines the amount of privacy 
amplification. By considering a single-photon polariza- 
tion input both from Alice and Bob, one can see that 
Bob should not apply the bit flip only when Alice and 
Bob use F-basis and $~ is detected in MU, and Bob 
should apply the bit flip in all the other successful events 
to share the same bit value. Accordingly, the bit error in 



X-basis is given by the successful detection event condi- 
tioned on that Alice and Bob's polarization are identical. 
As for y-basis, the bit error is $~ detection given the 
orthogonal polarizations or detection given the iden- 
tical polarization. 

Assuming completely random input polarization state, 
our converter successfully converts the single-photon 
pulse with a probability of 50%. Note in the normal 
experiment that the birefringence effect between Alice 
and the converter and the one between Bob and the con- 
verter are random and independent, however it only leads 
to fluctuating coincidence rate of Alice's and Bob's sig- 
nals at the Bell measurement, but does not affect the 
QBER. Moreover, the fluctuation increases the single- 
photon loss inserted into the Bell measurement. Espe- 
cially, the events that the output of the converter for Al- 
ice is the vacuum and the one for Bob is a single-photon, 
and vice versa would increase compared to the case where 
we have no birefringence effect. However, this is not a 
problem since the Bell measurement does not output the 
conclusive events in these cases unless the dark counting 
occurs. Thus, the random and independent polarization 
fluctuation in the normal experiment is not a problem, 
and we will simply assume in our simulation in Sec. IVI Bl 
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that this fluctuation can be modeled just by 50% loss. 
We emphasize that we do not rely on these assumptions 
at all when we prove the security, and our security proof 
applies to any channels and MUs. 

For the better performance and also for the simplicity 
of anal ysis , we assume the use of infinite number of decoy 
states [20| to estimate the fraction of the probability of 
successful event conditioned on that both of Alice and 
Bob emit a single-photon. One of the differences in our 
analysis from the work in |9( is that we will take into 
account the imperfection of Alice's and Bob's source, i.e., 
the decay of the fidelity between two density matrices 
in two bases. We also remark that since the H and V 
modes are defined locally in MU, Alice and Bob do not 
need to share the reference frame for the polarization 
mode, which is one of the qualitative differences from 
polarization encoding MIQKD scheme Q . 



V. SECURITY PROOF 

This section is devoted to the unconditional security 
proof, i.e., the security proof against the most general 
attacks, of our schemes. Since both of our schemes are 
based on BB84 and the basis-dependent flaw in both pro- 
tocols can be treated in the same manner, we can prove 
the security in a unified manner. 

If the states sent by Alice and Bob were basis indepen- 
dent, i.e., the density matrices of A-basis and F-basis 
were the same, then the security proof of the original 
BB84 [lHl] could directly apply (also see 21 1 for a bit 
more detailed discussion of this proof), however they 
are basis dependent in our case. Fortunately, security 
proof of standard BB84 with basis -dep endent flaw has 
already been shown to be secure [12H141 ] , and we general- 
ize this idea to our case where we have basis-dependent 
flaw from both of Alice and Bob. In order to do so, we 
consider a virtual protocol 12 14, 22] that Alice and Bob 
get together and the basis choices by Alice and Bob are 
made via measurement processes on the so-called quan- 
tum coin. In this virtual protocol of the phase encoding 
scheme I, Alice and Bob prepare joint systems in the state 

M 



= \(\^)e lo 2 ) B \o z ) a 

+ \o z ) E \o z ) b \i z ) a |4 +) (|-Vcu») \^+\HV^)) 

+ \W E \i*) b \o,) a |4 +) (HV«5» 

+ \i,) E \i x ) B \i z ) A \4 + H\-Woa>)) |4 +) (In») 



(3) 

Since just replacing the state, for instance 



4 +) (|l) s |0) J ,/V2+|0)Jl> r /V2) 



single-photon and the vacuum, is enough to apply the 
following proof to the phase encoding scheme II, we 
discuss only the security of the phase encoding scheme 
I in what follows. In Eq. ©, the first system denoted 
by E is given to Eve just after the preparation, and it 
informs Eve of whether the bases to be used by Alice 
and Bob match or not. The second system, denoted by 
B, is a copy of the first system and this system is given 
to Bob who measures this system with {|0 2 ) B ,|1 Z ) B } 
basis to know whether Alice's and Bob's bases match 
or not. If his measurement outcome is \0 z )b (|1z)b), 
then he uses the same (the other) basis to be used by 
Alice (note that no classical communication is needed 
in order for Bob to know Alice's basis since Alice and 
Bob get together). The third system, which is denoted 
by A and we call " quantum coin" , is possessed and 
to be measured by Alice along {10^)^ , |1 2 ) A } basis 
to determine her basis choice, and the measurement 
outcome will be sent to Eve after Eve broadcasts 
the measurement outcome at MU. Moreover, all the 

second systems of 
and 




/oil)) 
are sent to Eve. 



Note in this formalism that the information, including 
classical information and quantum information, available 
to Eve is the same as those in the actual protocol, and 
the generated key is also the same as the one of the 
actual protocol since the statistics of Alice's and Bob's 
raw data is exactly the same as the one of the actual 
protocol. Thus, we are allowed to work on this virtual 
protocol for the security proof. 

The first system given to Eve in Eq. ^ allows her to 
know which coherent pulses contain data in the sifted key 
and she can post-select only the relevant pulses. Thus, 
without the loss of any generalities of the security proof, 
we can concentrate only on the post-selected version of 
the state in Eq. (J3J as 



£0 



|o 2 ) A |4 +) (IV^»)|4 +) (l^» 



4 +) (l-iV5D))|^ +) (l-^» 



(4) 



where 1 and in the ket respectively represents the 



The most important quantity in the proof is the phase 
error rate in the code bits. The definition of the phase 
error rate is the rate of bit errors along Y"-basis in the 
sifted key if they had chosen F-basis as the measurement 
basis when both of them have sent pulses in A-basis. If 
Alice and Bob have a good estimation of this rate as well 
as the bit error rate in the sifted key (the bit error rate 
in A-basis given Alice and Bob have chosen A-basis for 
the state preparation), they can perform hashing in Y- 
basis and A-basis simultaneously [I?], [HJ to distill pairs 
of qubits in the state whose fidelity with respect to the 
product state of the maximally entangled state is 
close to 1. 

According to the discussion on the universal compos- 
ability (26j , the key distilled via A-basis measurement on 
such a state is composably secure and moreover exactly 
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the same key can be generated only by classical means, 
i.e., error correction and privacy amplification 3]. Thus, 
we are left only with the phase error estimation. For the 
simplicity of the discussion, we assume the large number 
of successful events n so that we neglect all the statistical 
fluctuations and we are allowed to work on a probability 
rather than the relative frequency. 

The quantity we have to estimate is the bit er- 
ror along F-basis, denoted by 6', given Alice and 

Bob send 



state, which 

is different from the experimentally available bit er- 
ror rate along F-basis given Alice and Bob send 

: v + \\~W aB ))' K j state. Intuitively, if 
the basis-dependent flaw is very small, S' y and 5 y should 
be very close since the states are almost indistinguish- 
able. To make this intuition rigorous, we briefly review 
the idea by [TJ], [JJJ which applies Bloch sphere bound 
27] to the quantum coin. Suppose that we randomly 
choose Z-basis or A-basis as the measurement basis for 
each quantum coin. Let n"/ z /2 and n"/ x /2 be fraction that 
those quantum coins result in 1 in Z-basis and X-basis 
measurement, respectively. What Bloch sphere bound, 
i.e., Eq. (13) or Eq. (14) in [H or Eq. (Al) in [TJ], 
tells us in our case is that no matter how the correla- 
tions among the quantum coins are and no matter what 
the state for the quantum coins is, thanks to the ran- 
domly chosen bases, the following inequality holds with 
probability exponentially close to 1 in n, 



(1 - 2 lz f + (1 - 2 lx f < 1 



(5) 



By applying this bound separately to the quantum coins 
that are conditional on having phase errors and to those 
that are conditional on having no phase error, and fur- 
thermore by combining those inequalities using Bayes's 
rule, we have 



1 - 2A < 



(6) 



Here, A is equivalent to the probability that the measure- 
ment outcome of the quantum coin along -basis is (l^) 
given the successful event in MU. Note that this proba- 
bility can be enhanced by Eve who chooses carefully the 
pulses, and Eve could attribute all the loss events to the 
quantum coins being in the state 10^). Thus, we have an 
upper bound of A in the worst case scenario as 



A < A ini / 7s , 



(7) 



and 



x (4 +) (lvM)|< +) d-iV«i»))/2, 



(8) 



where 7 SUC is the frequency of the successful event. 

Note that we have not used the explicit 
form of and where (3 = 



y/otg, —iyjas, in the derivation of Eqs. 
| , and the important point is that the state 



©, 0, and (0 

l^x^/?)) and \^>y C '(^)) are the purification of Alice's 
and Bob's density matrices for both bases. Since there 
always exists purification states of p( x ' and p^ Y \ which 
are respectively denoted by |f2( x )) and such that 

(nW|n( y >) = f(/ x \ p ^) = Tt(lv^Vp^). 

Ai n i can be rewritten by 



Aim = l-F(pW p^)F(Pb>*') / 2 . ( 9 ) 



IX) AY) 



(X) 

where p A represents Alice's density matrix of X basis 
and all the other density matrices are defined by the same 
manner. Our expression of Ai n i has the product of two 
fidelities, while the standard BB84 with basis-dependent 
flaw in |L2h141 | has only one fidelity (the fidelity between 
Alice's density matrices in X and F bases). The two 
products may lead to poor performance of our schemes 
compared to that of standard QKD in terms of the 
achievable distances, however our schemes have the huge 
advantage over the standard QKD that there is no side- 
channel in the detectors. 

Finally, the key generation rate G, given X-basis, in 
the asymptotic limit of large n is given by 



g = itl (i - - HS' y )) 



(10) 



where 5 X is the bit error rate in X-basis, f(S x ) is the 
inefficiency of the error correcting code, and h(x) = 
— xlog 2 x — (1 — x) log 2 (l — x). We can trivially obtain 
the key generation rate for F-basis just by interchang- 
ing X-basis in all the discussions above to F-basis. We 
remark in our security proof that we have assumed noth- 
ing about what kind of measurement MU conducts but 
that it announces whether it detects the successful event 
and the type of the event (this announcement allows us 

to calculate 7^ and the error rates). Thus, MU can be 
assumed to be totally under the control of Eve. 



VI. SIMULATION OF THE KEY GENERATION 
RATES 



In the following subsections, we show some examples 
of the key generation rate of each of our schemes assum- 
ing typical experimental parameters taken from Gobby- 
Yuan-Shields (GYS) experiment [28[ unless otherwise 
stated. Moreover, we assume that the imperfect phase 
modulation is the main source of the decay of the fidelity 
between the density matrices in two bases, and we eval- 
uate the effect of this imperfection on the key generation 
rate. 
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FIG. 4: The key generation rates of each setting as a function 
of the distance between Alice and Bob with the alignment 
error rate (e a u) of 3.3% and 4.0%. Dashed line: (a) MU is 
at Bob's side, i.e., Ib — 0. Solid line: (b) MU is just in the 
middle between Alice and Bob. The lines achieving the longer 
distances correspond to 3.3% of e a n. See also the main text 
for the explanation. 
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FIG. 5: Optimal mean photon numbers emitted by Alice's 
source (a a) that outputs Fig. [4] as a function of the distance 
between Alice and Bob. 



A. Phase encoding scheme I 

In the phase encoding scheme I, the important quantity 
for the security A; n ; can be expressed as 



1 - e^ aA+rXB) (cos a A + sma A ) 



x (cos as + sin as) 



(11) 



Note that this quantity is dependent on the intensity of 
Alice's and Bob's sources. As we have mentioned in Sec. 
Ill, this quantity may be estimated relatively easily via 
tomography involving homodyne measurement. 

To simulate the resulting key generation rate, we as- 
sume that the bit error stems from the dark counting as 
well as alignment errors due to imperfect phase locking 
or imperfect optical components. The alignment error is 
assumed to be proportional to the probability of having 
a correct click caused only by the optical detection not 
by the dark counting. Moreover, we make assumptions 
that all the detectors have the same characteristics for 
the simplicity of the analysis, and Alice and Bob choose 
the intensities of the signal lights in such a way that the 



intensities of the incoming pulses to MU are the same. 
Finally, we assume the quantum inefficiency of the de- 
tectors to be part of the losses in the quantum channels. 
With all the assumptions, we may express the resulting 
experimental parameters as 



/sue 



Tsuc 

"in 
VA 
VB 



= bdark + (1 - Pdark)(l - 
+ (1 - Pdark)e~ 2Qi "Pdark 

/sue 1 /sue 

e a li(l - Pdark) 2 (l 



-2a in 



)](1 -Pdark) 



'V 



-2ai, 



-2a h 



(1 - Pdark)e "'Pdark 
aAVA = OL B TlB 
?7det,Al0-^/ 10 



(x) 
sue 



(12) 



Here, pdark is the dark count rate of the detector, e a ii 
is the alignment error rate, T)a(t)b) is Alice's (Bob's) 
overall transmission rate, rjdet.A (^det.fl) is the quantum 
efficiency of Alice's (Bob's) detector, £,a(£,b) is Alice's 
(Bob's) channel transmission rate, and I a {Ib) is the dis- 
tance between Alice (Bob) and MU. The first term and 
the second term in S x or S y respectively represent the 
alignment error, which is assumed to be proportional to 
the probability of having correct bit value due to the de- 
tection of the light, and errors due to dark counting (one 
detector clicks due to the dark counting while the other 
one does not). 

We take the following parameters from GYS experi- 
ment [28]: f{S x ) = 1.22, p dark = 8.5 x lO" 7 , f = 0.21 
(dB/km), r) dct ^ A = r?det,s = 0.045, and e a u = 0.033, and 
we simulate the key generation rate as a function of the 
distance between Alice and Bob in Fig. 2] In the fig- 
ure, we consider two settings: (a) MU is at Bob's side, 
i.e., Ib = (b) MU is just in the middle between Alice 
and Bob. The reason why we consider these setting is 
that the basis-dependent flaw is dependent on intensities 
that Alice and Bob employ, and it is not trivial where we 
should place MU for the better performance. 

Since MDIQKD polarization encoding scheme without 
basis-dependent flaw achieves almost twice the distance 
of BB84 0, we may expect that the setting (b) could 
achieve almost twice the distance of BB84 without phase 
randomization that achieves about 13 (km) [l4[ with the 
same experimental parameters. The simulation result, 
however, does not follow this intuition since we have the 
basis-dependent flaw not only from Alice's side but also 
from Bob's side. Thus, the advantage that we obtain 
from putting MU between Alice and Bob is overwhelmed 
by the double basis-dependent flaw. In each setting, we 
have optimized the intensity of the coherent pulses a A 
for each distance (see Fig. [5|). 

In order to explain why the optimal a A is so small, 
note that scheme I intrinsically suffers from the basis- 
dependent flaw due to Eq. (fTTj) . This means that if we 
use relatively large a A , then we cannot generate the key 
due to the flaw. Actually, when we set a a =0.1, which 
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is a typical order of the amplitude for decoy BB84, one 
can see that the upper bound of the phase error rate is 
1/2 even in the zero distance, i.e., I — 0, and we have no 
chance to generate the key with this amplitude. Thus, 
Alice and Bob have to reduce the intensities in order to 
suppress the basis-dependent flaw. Also, as the distance 
gets larger and the losses get increased, Alice and Bob 
have to use weaker pulses since larger losses can be ex- 
ploited by Eve to enhance the basis-dependent flaw ac- 
cording to Eq. ([7]), and they can reduce the intensities 
until it reaches the cut-off value where the detection of 
the weak pulses is overwhelmed by the dark counts. 

In the above simulation, we have assumed that Alice 
and Bob can prepare states very accurately, however in 
reality, they can only prepare approximate states due to 
the imperfection of the sources. This imperfection gives 
more basis-dependent flaw, and in order to estimate the 
effect of this imperfection, we assume that the fidelity 
between the two actually prepared density matrices in 
two bases is approximated by the fidelity between the 
following density matrices (see Appendix B for the detail) 



/2 
(13) 



and 



/2, 
(14) 



where we assume an imperfect phase modulator whose 
degree of the phase modulation error is proportional to 
the target phase modulation value, and S represents the 
imperfection of the phase modulation that is related with 
the extinction ratio rj cx as 



tan ■ 



(15) 



In this equation, we assume that the non-zero extinction 
ratio is only due to the imperfection of the phase mod- 
ulators. Since imperfect phase modulation results in the 
same effect as the alignment errors, i.e., the pulses are 
routed to a wrong output port, we assume that the align- 
ment error rate is increased with this imperfection. Thus, 
in the simulation accommodating the imperfection of the 
phase modulation, we replace e a n with e a n + 16rj ex . Here, 
we have used a pessimistic assumption that the effect of 
the phase modulation becomes 16-times higher than be- 
fore since each of Alice and Bob has one phase modulator 
and MU has two phase modulators for the phase shift of 
two polarization modes (note from Eq. (|15[) that r/ cx is 
approximately proportional to 5 2 , thus 4 times degrada- 
tion in terms of the accuracy of the phase modulation 
results in 16-times degradation in terms of the extinction 
ratio). We also remark that in practice, it is more likely 
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FIG. 6: The key generation rates of the each setting as a 
function of the distance between Alice and Bob with a base- 
line alignment error rate (e a ii) of 3.3% and imperfect phase 
modulators. So = 0.063 represents the typical amount of the 
phase modulation error, and we plot the key rate for smaller 
imperfection of So/3 and So/5. Dashed line: MU is at Bob's 
side, i.e., Ib = 0. Solid line: MU is just in the middle between 
Alice and Bob. 



that the phase encoding errors are independent, in which 
case a factor of 4 will suffice and the key rate will actually 
be higher than what is presented in our paper. On the 
other hand, we have to use the following A; n ; when we 
consider the security: 

A ini = [l - F(p^ ct) (a Al S), P ^ ct \a A ,S)) 

x F(/£ ct) (a B ,6),p { Y Act) (a B ,6))]/2. (16) 

In Figs. H] and [7J we plot the key generation rate and 
the corresponding optimal Alice's mean photon numbers 
(a a) as a function of the distance between Alice and 
Bob. In the figures, we define \6\ that satisfies ij cx — 



tan ; 



= 10- 



as 



0.063), where r? ox = 10~ 3 is 
the typical order of rj cx in some experiments [29j . We 
have confirmed that we cannot generate the key when 
Tjex = 10~ 3 . However, we can see in the figures that if 
the accuracy of the phase modulation is increased three 
times or five times, i.e., S = So/3 and S — So/5, then 
we can generate the key. Like the case in Fig. [SJ the 
small optimal mean photon number can be intuitively 
understood by the arguments that we have already made 
in this section. 

In order to investigate the feasibility of the phase en- 
coding scheme I with the current technologies, we replace 
Pdark = 8.5 x 10~ 7 , r] dctt A = Vdet,B = 0.045, and e„ii = 
0.033 with p dark = l.OxlO" 7 , Vdct , A = 7?dot,B = 0.15 [aij, 
and e a u = 0.0075 @. We see in Fig. [15] that the key gen- 
eration is possible over much longer distances with those 
parameters assuming the precise control of the intensi- 
ties of the laser source. We also show the corresponding 
optimal mean photon number ctA in Fig. 1191 We note 
that thanks to the higher quantum efficiency, the suc- 
cess probability becomes higher, following that Alice and 
Bob can use larger mean photon number a a compared 
to those in Figs. [71 and[TTjl 
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FIG. 7: Optimal mean photon numbers emitted by Alice's 
source (a a) that outputs Fig. [6] as a function of the distance 
between Alice and Bob. 
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FIG. 8: The key generation rates of the each setting as a 
function of the distance between Alice and Bob with the latest 
parameters such as e a ij = 0.0075 with pdark = 1.0 x 10~ 7 , 
f?dct,A = »7det,B = 0.15 [30| . and So = 0.063. Dashed line: MU 
is at Bob's side, i.e., l B = 0. Solid line: MU is just in the 
middle between Alice and Bob. 



B. Phase encoding scheme II 

In the phase encoding scheme II, note that we can gen- 
erate the key only from the successful detection event in 
MU given both of Alice and Bob send out a single-photon 
since if either or both of Alice and Bob emit more than 
one photon, then Eve can employ the so-called photon 
number splitting attack [31] . Thus, the important quan- 
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FIG. 9: Optimal mean photon numbers emitted by Alice's 
source (a a) that outputs Fig. [I8]as a function of the distance 
between Alice and Bob. 



tities to estimate are Q^x ,X \ Sy 1 ^, S Xl Q x , which respec- 
tively represents gain in X-basis given both of Alice and 
Bob emit a single-photon, the phase error rate given Al- 
ice and Bob emit a single-photon, overall bit error rate in 
X-basis, and overall gain in X-basis. To estimate these 
quantities stemming from the simultaneous single-photon 
emission, we assume the use of infinite number of decoy 
states for the simplicity of analysis [20]. Another im- 
portant quantity in our study is the fidelity {Ftp) 
between Alice's (Bob's) X-basis and y-basis density ma- 
trices of only single-photon component, not whole optical 
modes. If this fidelity is given, then we have 



A 



(i,i) 



1 



* A B 



(17) 



For the simplicity of the discussion, we consider the case 



of F^ 1 — Fg^ = F^ in our simulation. The estimation 
of the fidelity only in the single-photon part is very im- 
portant, however to the best of our knowledge we do not 
know any experiment directly measuring this quantity. 
This measurement may require photon number resolv- 
ing detectors and very accurate interferometers. Thus, 
we again assume that the degradation of the fidelity is 
only due to the imperfect phase modulation given by Eq. 
(fT5|) . and we presume that the fidelity of the two den- 
sity matrices between the two bases is approximated by 
the fidelity between the following density matrices (see 
Appendix B for the detail) 
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With these parameters, we can express the key_^ genera- 
tion rate given Alice and Bob use X-basis as 



G = Q x 



where Sy 1 ' 1 ^ is the (1,1) version of 5' y in Eq. (fTU|) . 

To simulate the resulting key generation rate, the bit 
errors are assumed to stem from multi-photon compo- 
nent, the dark counting, and the misalignment that is 
assumed to be proportional to the probability of obtain- 
ing the correct bit values only due to the detection by 
optical pulses. Like before, we also assume that all the 
detectors have the same characteristics, Alice and Bob 
choose the intensities of the signal lights in such a way 
that the intensities of the incoming pulses to MU are the 
same, and all the quantum inefficiencies of the detectors 
can be attributed to part of the losses in the quantum 
channel. Finally, Alice's and Bob's coherent light sources 
are assumed to be phase randomized, and the imperfect 
phase modulation is represented by the increase of the 



(i,i) 



l-hy^Y)] - f(5 x )Q x h(S x ) , (19) 
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alignment error rate. With these assumptions, we may 
have the following resulting experimental parameters 



by 



Qy A) 
5 (1,1) 

"y 

Qx 
6 X 

V 



VA 
'IB 



4a A a BV AVBe- 2{aA+aB) 

' (1 ~ Pdark) 2 Pdark (1 ~ Pdark) 2 ' 

2 2 - 

1^(2,1) + w P,o) 

{Aa A aBVAVBe- 2(aA+aB) Pdaik (l - p da rk) 2 /2 

2(e ali + ^)a A a B i lAVB e^ aA+aB \l - p dark ) 2 
(^i) +14 ,(2,o ))/2 | /Q (i,i) 

5(1,1) 



-2(qa+«b) 



77^(1 - Tj B ) + (1 - ?7A)?7i 



Pdark (1 ~ Pdark) 

\&a A a B {l - T]a)(1 - r, B )e- 2 ^ A+a ^ 

Pdarki 1 -Pdark) 2 

2 [1 - (1 - PdarkK"'"] 2 (1 ~ Pdark) V 

V r +(e ali + 4ry cx )2(l-e- Q -) 2 

(l-pdark) 2 e- 2a '" 
Pdark (1 ~ Pdark) 



V 



2tt 



2 71 



l-(l-Pda rk )e-"'" |1+e 



(l-Pdark)e 
Pdark (1 ~ Pdark) 



2tt 



(10 



11 



1 - (1 - J3dark)e 



-a ia \l-e ie \ 2 



(l-pdarkK^ 11 ^ ' 2 

a A f]A = aBVB 
r?dct,BlO-« B ' s/1 72 



(20) 



Note that a A (a B ) represents each of the intensity of Al- 
ice's (Bob's) signal light and the reference light, not the 
total intensity of them, and ~q A and rj B are divided by 
2 since the conversion efficiency of our converter is 50%. 
4 in 4rj cx again comes from the pessimistic assumption 
that each of Alice's and Bob's phase modulator is imper- 
fect, and W^ 2 ' 1 ^ (W^ 2,0 )) represents the probability of the 
event where both of Alice and Bob emit a single-photon 
and only one (zero) photon is detected but the successful 
detection event is obtained due to the dark counting. On 
the other hand, the quantity that quantifies the basis- 
dependent flaw A in the present case is upper bounded 



A < A| n W \Q^/(4a A a B e- 2 ^ A+a ^) 
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where <2 (M) /Aa A a B e~ 2( - aA+aB) is the probability that 
MU receives a single-photon both from Alice and Bob 
simultaneously conditioned on that each of Alice and Bob 
sends out a single-photon. We remark that A; n ; in this 
scheme is only dependent on the accuracy of the phase 
modulation. This is different from scheme I where the 
manipulation of the intensities of the pulses can affect 
the basis-dependent flaw. 

In the simulation, we again assume GYS experimental 
parameters and we consider two settings: (a) MU is at 
Bob's side and (b) MU is just in the middle between Alice 
and Bob. Note that Aj n j is independent of a A and a B in 
the phase encoding scheme II case. 

In Fig. [TU1 we plot the key generation rates of (a) and 
(b) for S = 0, 5 = 5 /50, S = 6 /20, S = S /10 (re- 
call from Eq. JUJ that S ~ 0.0063224 that corresponds 
to the typical extinction ratio of 0.1%), which respec- 
tively correspond to = 1.0, F (1 1 - 1 - 1.0 x 10~ 7 , 
FW ~ 1 - 6.6 x 10~ 7 , and - 1 - 2.5 x 10~ 6 , and 
the achievable distances of (a) and (b) increase with the 
improvement of the accuracy, i.e., with the decrease of 
5. We have confirmed that no key can be distilled in 
(a) and (b) when 5 > Sq/7. The figure shows that the 
achievable distance drops significantly with the degra- 
dation of the accuracy of the phase modulator, and the 
main reason of this fast decay is that A is approximated 
by Aj n j /0(rj A rj B ) and this dominator decreases exponen- 
tially with the increase of the distance. 

We also plot the corresponding optimal a A in Fig. 
1111 Notice that the mean photon number increases in 
some regime in some cases of (a), and recall that this 
increase does not change Aj n i. If we increased the inten- 
sity in scheme I with the distance, then we would have 
more basis-dependent flaw, resulting in shortening of the 
achievable distance. This may be an intuitive reason why 
we see no such increase in Figs. [5J El and 9. 

Like in the phase encoding scheme I, we investigate the 
feasibility of the phase encoding scheme II with the cur- 
rent technologies by replacing pdark = 8.5 x 10" 7 , /fact, A = 
?7dct,B = 0.045, and e aU = 0.033 with p dark = 1.0 x 10" 7 , 
Vdet,A = Vdet,B = 0.15 [30], and e aU = 0.0075 1. With 
this upgrade, we have confirmed the impossibility of the 
key generation, however if we double the quantum effi- 
ciency of the detector or equivalently, if we assume the 
polarization encoding so that the factor of 1/2, which is 
introduced by the phase-to-polarization converter, is re- 
moved both from r\ A and r\ B in Eq. (|20p . then we can 
generate the key, which is shown in Fig. [T^] (also see Fig. 
13). 

Finally, we note that our simulation is essentially the 
same as the polarization coding since the fact that we 
use phase encoding is only reflected by the dominator 
of 2 in r\ A and r\ B in Eq. (|2U)) . Thus, the behavior of 
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FIG. 10: The key generation rates of each setting as a function 
of the distance. Dashed line: (a) MU is at Bob's side, i.e., 
Ib = 0. Solid line: (b) MU is just in the middle between Alice 
and Bob. We plot the key generation rates of each case when 
8 = 0, S — So/50, S — <5o/20, S = <5o/10 where S is proportional 
to the amount of the phase modulation error, and for each 
case of (a) and (b) the key generation rates monotonously 
increase with the decrease of 5., i.e., with the improvement 
of the phase modulation. The key rates of (a) and (b) when 
<5o/10 are almost superposed. See also the main text for the 
explanation. 
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FIG. 12: The key generation rates of each setting as a function 
of the distance with pdark = 1.0 x 10~ 7 , ?7det,A = J?det,B = 
0.30, and So = 0.063. Note that we double rjdct,A = f?det,s 
compared to the one of [30l ]. or we effectively consider the 
polarization encoding Dashed line: (a) MU is at Bob's 
side, i.e., Ib = 0. Solid line: (b) MU is just in the middle 
between Alice and Bob. The key rates are almost superposed. 
See also the main text for the explanation. 
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FIG. 13: The optimal mean photon number emitted by Alice 
(a a) that outputs Fig. 1121 The bold lines correspond to (a). 
See also the main text for the explanation. 



FIG. 11: The optimal mean photon number emitted by Alice 
(a a) that outputs Fig. 1101 The bold lines correspond to (a). 
See also the main text for the explanation. 



the key generation rate against the degradation of the 
state preparation is the same also in polarization based 
MDIQKD. Also note that even in the standard BB84, 
A decays exponentially with increasing distance. Thus, 
we conclude that very precise state preparation is very 
crucial in the security of not only MDIQKD but also in 
standard QKD. We also note that our estimation of the 
fidelity might be too pessimistic since we have assumed 
that the degradation of the extinction ratio is only due 
to imperfect phase modulation. In reality, the imperfec- 
tion of Mach-Zehnder interferometer and other imper- 
fections should contribute to the degradation, and the 
fidelity should be closer to 1 than the one based on our 
model. 



VII. SUMMARY AND DISCUSSION 

In summary we have proposed two phase encoding 
MDIQKD schemes. The first scheme is based on the 
phase locking technique and the other one is based on 
the conversion of the pulses in the standard phase en- 
coding BB84 to polarization modes. We proved the se- 
curity of the first scheme, which intrinsically possesses 
basis-dependent flaw, as well as the second scheme with 
the assumption of the basis-dependent flaw in the single- 
photon part of the pulses. Based on the security proof, 
we also evaluate the effect of imperfect state preparation, 
and especially we focus our attention to the imperfect 
phase modulation. 

While the first scheme can cover relatively short dis- 
tances of the key generation, this scheme has an advan- 
tage that the basis-dependent flaw can be controlled by 
the intensities of the pulses. Thanks to this property, 
we have confirmed based on a simple model that 3 or 5 
times of the improvement in the accuracy of the phase 
modulation is enough to generate the key. Moreover, we 
have confirmed that the key generation is possible even 
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FIG. 14: The key generation rates of the standard BB84 with 
infinite decoy states from X-basis when 5 — 0, 5 = So, S = 25q 
where 8 is the amount of the phase modulation error. 
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FIG. 15: The optimal mean photon number emitted by Alice 
(a a) that outputs Fig. Q3] 

without these improvements if we implement this scheme 
by using the up-to-date technologies and the control of 
intensities of the laser source is precise. On the other 
hand, it is not so clear to us how accurate we can lock 
the phase of two spatially separated laser sources, which 
is important for the performance of scheme I. Our result 
still implies that scheme I can tolerate up to some extent 
of the imperfect phase locking errors, which should be ba- 
sically the same as the misalignment errors, but further 
analysis of the accuracy from the experimental viewpoint 
is necessary. We leave this problem for the future studies. 

The second scheme can cover much longer distances 
when the fidelity of the single-photon components of Y- 
basis and A-basis density matrices is perfect or extremely 
close to perfect. When we consider the slight degrada- 
tions of the fidelity, however, we found that the achiev- 
able distances drop significantly. This suggests that we 
need a photon source with a very high fidelity, and very 
accurate estimation of the fidelity of the single-photon 
subspace is also indispensable. 

In our estimation of the imperfection of the phase mod- 
ulation, we simply assume that the degradation of the ex- 
tinction ratio is only due to imperfect phase modulation, 
which might be too pessimistic, and the imperfection 
of Mach-Zehnder interferometer and other imperfections 
contribute to the degradation. Thus, the actual fidelity 
between the density matrices of the single-photon part 



in two bases might be very close to 1, which should be 
experimentally confirmed for the secure communication. 
We note that the use of the passive device to prepare the 
state [32| may be a promising way for the very accurate 
state preparation. 

We remark that the accurate preparation of the state 
is very important not only in MDIQKD but also in stan- 
dard QKD where Eve can enhance the imbalance of the 
quantum coin exponentially with the increase of the dis- 
tance. To see this point, we respectively plot in Fig. 
[141 and Fig. [15] the key generation rate of standard 
BB84 with infinite decoy states in A-basis and its op- 
timal mean photon number assuming pdark = 1-0 X 10~ 7 , 
r] det , A = 0.15 ;H, e ali = 0.0075, f(S x ) = 1.22, and 
£ = 0.21. Again, So ~ 0.063 is the typical value of the 
phase modulation error, and we see in the figure that the 
degradation of the phase modulator in terms of the ac- 
curacy significantly decreases the achievable distance of 
secure key generation. One notices that standard decoy 
BB84 is more robust against the degradation since the 
probability that the measurement outcome of the quan- 
tum coin along X-basis is |l x ) given the successful detec- 
tion of the signal by Bob is written as Ai n i = |(1 — F^) 

rather than Aj n i = |(1 — Fjp Fg ). On the other hand, 
one has to remember that we trust the operation of Bob's 
detectors in this simulation, which may not hold in prac- 
tice. 

Finally, we neglect the effect of the fluctuation of the 
intensity and the center frequency of the laser light in 
our study, which we will analyze in the future works. In 
summary, our work highlights the importance of very ac- 
curate preparation of the states to avoid basis-dependent 
flaws. 
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Appendix A: Scheme I without noises and losses 

In this appendix, we give a detailed calculation about 
how scheme I works when there is no channel losses 
and noises. In order to calculate the joint probability 
that Alice and Bob obtain type-0 successful event, where 
only the detector DO clicks, and they share the max- 
imally entangled state l^" 1 "), we introduce a projector 

fl Do = P f|0) Do ^ P (|0} Dl ) that corresponds to type- 

successful event. Here, represents the non- vacuum 
state. The state after Alice and Bob have the type-0 
successful event n Do 10^1 bi do di ( scc ^q- © for the 
definition of |C)ai bi do di) can De expressed by 

iyU.-BlIlDo |C)A1,B1,D0,D1 = ~/= I * + ) A 1,B1 '^DO I°)di 

+ ^I v1/+ )ai, B iI^)doIO)di • 

(Al) 

Here, Iai.bi is an identity operator on Al and BI, a and 
b are complex numbers, and \<po) and |</>i) are orthonor- 
mal bases, which are related with each other through 



output from one of the two output ports gives us the 
desired state and the other output port gives a wrong 
state. Let T and t be transmission rates of the pulses to 
the correct port and the wrong port, which satisfies 



T + t = 1 

_ t 
Vex — Tj; , 



(BI) 



where r/ cx is the extinction ratio. In typical experiments, 
T] cx is in the order of 10 -3 [2!|. We assume that the Mach- 
Zchndcr interferometer is perfect and the imperfection 
of the extinction ratio is only due to imperfect phase 
modulations. 

Now, suppose that we plug \\fa) and | e l ( 7r+<5 ) i/a) into 
the perfect Mach-Zehnder interferometer, where S repre- 
sents the imperfect the phase modulation when we want 
to apply phase shift of tt. Since Mach-Zehnder interfer- 
ometer is composed of 50:50 beam splitters, r/ cx can be 



tan : 



and thus we can obtain the im- 



represented by p..., ,, 
perfection of S by solving the following equation 



S 

tan - 
2 



(B2) 




a |^o> + b |0i> 



P(|0» -V20 7 ) = o|^o)-6|0i> . (A2) 
By a direct calculation, one can show that 

2a'\2 



\b\' 2 



(1 - e~ 2a ) 
2 

(1 -e- Aa ') 



(A3) 



Finally, by taking the partial trace over the system DO 
and DI in Eq. (|Aip . we can see that Alice and Bob 
share either |$ + ) or probabilistically, and the joint 
probability that they obtain type-0 successful event and 
share the maximally entangled state \^ + ) is given by 
|6| 2 /2. In the same manner, we can readily calculate the 
other joint probabilities. 



For instance, when r] cx = 10~ 3 , we have \6\ ~ 0.063 = 6q 
that is equivalent to about 3.62 degrees. We rely on this 
equation to estimate the accuracy of the phase modula- 
tor, and we assume that the actual phase modulation is 
9+\S\8/ir, i.e., the degree of the imperfect phase modula- 
tion is proportional to the desired phase modulation. We 
remark that 3.62 degrees seem rather large to us, and we 
believe that this can be substantially improved through 
careful calibration and/or engineering of the preparation 
process. 

In the case of scheme I, the ideal density matrix for X 
(a\ + \—a) (— a\)/2 and the one for Y 

ia) (ia\ + |— ia) (— ia\)/2. Based on our 
imperfect phase modulation model, we have the density 
matrix for the actually generated states in X basis as 



basis p^ dca1 ' is (| a 

, . (Ideal) . 

basis py is 



,4 Act W) 



(|V5><, 



at 



(- 



fa\ 



/2 
(B3) 



Appendix B: Imperfection of the phase modulator 

In this appendix, we give an estimation of the fidelity 
between the density matrices in X and Y bases by using 
the extinction ratio. In this estimation, we assume that 
the source of the imperfections is only due to the imper- 
fect phase modulation and the stability of the intensity 
control of the coherent light source is negligible. 

Imagine that we generate two pulses, one of which is 
the reference light and the other one of which is the signal 
light, and these pulses are spatially separated. Then, we 
input these pulses into a Mach-Zehnder interferometer, 
which is composed of two 50:50 beam splitters, and the 



and the one for Y basis as 



p { Y Act \a,6) = ( 



/2- 
(B4) 



Here, note that when we want to prepare | -y/ce) , we do 
not apply any phase modulation. 

In the case of scheme II, the ideal single-photon den- 
sity matrix for X basis p(* dea1 ' 1 ) j s (|0a;) (0^1 + jl^) (\ x \)/2 
and the one for Y basis p^ dca1 ^) i s (|o y ) (0 y | + |l v ) (l y \)/2. 
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With the assumption on the accuracy of the phase mod- 
ulator, we have the density matrix for the actually gen- 
erated states in X basis as 



(Act.l) 

Px 



P 



(|0« 



II. 



P 



(|0 z )- e ^|l 2 ))/V2])/2 (B5) 



and the one for Y basis as 



(Act.l) 

Py 



i\S\/2 



= (P[(\o z ) + i< 

+ P\(\0 Z ) -ie- 1 ^' 2 



U)/V2 

2 )/2. (B(i) 
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FIG. 16: The revised figure for Fig. 8 in our paper. 



Appendix C: Erratum: Phase encoding schemes for 

measurement device independent quantum key 
distribution and basis-dependent flaw [Phys. Rev. A 
85, 042307 and arXi v:lllQ 413 

We would like to correct Eq. (9) in our paper and, 
subsequently, modify figures for the key generation rates. 
These corrections do not affect the validity of the main 
conclusions reported in the paper. The correct form of 
Eq. (9) in our paper [K. Tamaki, H-K. Lo, C-H. F. 
Fung, and B. Qi , Phys. Rev. A 85, 042307 (2012) and 
larXiv:1111.3413j should be 
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FIG. 17: The revised figure for Fig. 9 in our paper. 



A ini = Min ( A^, A|^ )N . 



(CI) 



where 



1 - Max fl tW c( A)Re( e ie (V A) 



(A) 

xA 



(C2) 



A (B) EE 

ini 



1 - Max e>e ( B) e CB)Re ( e w {^ vc(B) 



,{B) 



(B) 



x FU A X \ P T) /2- 



(C3) 



Here, < < 2ir, < fffi < 2ir, and < ^ < 2ir, 



and 



(A) 



(A) 



is defined by 



(A) 



Aq 



Xow 



Aq 



X.1W J 



should be chosen in such a way that it maximizes the 
inner product in Eq. (C2) or (C3). One can similarly 



define 



(B) 



), and 8 is introduced via considering a 
joint state involving the quantum coin as 
1 



(A) 

xA 



(B) 

xA 



+ e w \l 



z/C 



(A) 



(A) 



(B) 

YAy 



.(C5) 



where 



is a purification of pi^, which is the state 



that Alice actually prepares for the bit value i in basis 
W(= X, Y), and Aq is Alice's qubit system. One can 

choose any purification for x[w\ anc ^ m particular it 



Due to this change, the figures for the key generation rate 
have to be revised. As the examples of revised figures, we 
show the revised version of Figs. 8, 9, 12, and 13, which 
are the most important figures for our main conclusions 
to hold. Notice that there are only minor changes in 
Figs. 8 and 9 and the changes in Figs. 12 and 13 are 
relatively big. However, the big changes do not affect 
the validity of the main conclusions in our paper, which 
is the importance of the state preparation in MDIQKD 
and the fact that our schemes can generate the key with 
the practical channel mode that we have assumed. 
Justification of Eq. (CI) 

For the derivation of Eq. (|C1|) . we invoke Koashi's 
(C4)proof [13 ■ To apply Koashi's proof, it is important to en- 
sure that i) one of the two parties holds a virtual *qubit* 
(rather than a higher dimensional system) and ii) the 
fictitious measurements performed on the virtual qubit 
have to form *conjugate* observables. Therefore, it is 
not valid to consider fidelity alone (which allows arbi- 
trary purifications that may not satisfy the conjugate 
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FIG. 18: The revised figure for Fig. 12 in our paper. Two 
lines are superposed. 
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FIG. 19: The revised figure for Fig. 13 in our paper. Two 
lines are superposed. 



requirements. 

Since the difference between Eq. (C2) and Eq. (C3) 
comes from whether we consider Alice's virtual qubit or 
Bob's virtual qubit, we focus only on Eq. (C2) and the 
same argument holds for Eq. (C3). In Koashi's proof, 
the security is guaranteed via two alternative tasks, (i) 
agreement on X (key distillation basis) and (ii) Alice's 
or Bob's preparation of an eigenstate of Y, the conjugate 
basis of X, with use of an extra communication channel. 
The problem with the original (i.e. uncorrected) version 
of Eq. (9) is the following. If we use the uncorrected 
version of Eq. (9) in our paper, then the use of the fidelity 
means that the real part in Eq. (C2) is equivalent to 



X,0 j 



with the maximization over 



all possible local unitary operators U Aq- In this case, 
if Alice performs a measurement along X basis, then it 
violates the correspondence between her sending state 
and her qubit state |iw).Ag m general, an d thus, 
in the uncorrected version of Eq. (9) in our paper, the 
argument based on the fidelity does not guarantee the 
security of the protocol. In contrast, with the corrected 
version of Eq. (9) in our paper, since the maximization 

over 9 and in Eq. (C2) preserves the relationship 
between Alice's sending state and her qubit state as well 
as the conjugate relationship between X and Y, we can 
apply Koashi's proof for the security argument of the 
protocol. 



observables requirement). Fortunately, it turns out to 
be easy to modify our equation to satisfy the above two 



We thank X. B. Wang [34j for raising the concern about 
the validity of Eq. (9) in our paper. 
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